129 matches found
DropSpawn_BOF
DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...
CVE-2017-11783
CVE-2017-11783 1day Exploit by sheisback It isn't complete exploitexec cmd with system privilege, only create file in system32. So you will complete this, need consent.exe uac technique. Reference A view into ALPC-RPC by Clément Rouault & Thomas Imbert, 2017 PacSec...
CVE-2024-31771
CVE-2024-31771 Écriture arbitraire de fichier dans TotalAV TotalAV version 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 Chronologie : 13 février 2024 : Découvert que la version 6.0.740 était vulnérable et signalé à TotalAV. 15 février 2024 ...
TrustJack
TrustJack Encore un PoC pour https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows Article de blog : https://redteamer.tips/?p=108 À utiliser avec un cmd qui fait ce que vous voulez, pour une dll qui ouvre un cmd, https://github.com/jfmaes/CMDLL. Consultez la liste sur le site de wietze pou...
ShadowSteal
ShadowSteal | CVE-2021-36934 Implémentation pure Nim pour exploiter CVE-2021-36934, la vulnérabilité SeriousSAM d'élévation de privilèges locaux LPE. Pas sûr pour l'OPSEC... pour l'instant ;. Je ne revendique pas la découverte de cette exploitation. Démarrage rapide Construire avec Docker Démarre...
CS-DropSpawn_BOF
DropSpawn Введение DropSpawn — это BOF для CobaltStrike, используемый для запуска дополнительных Beacon'ов через относительно малоизвестный метод перехвата DLL DLL hijacking. Работает в связках x86-x86, x64-x64 и x86-x64/наоборот. Используйте как альтернативу внедрению в процессы. Исполняемые фай...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 Исправление PowerShell Этот PowerShell-скрипт исправляет CVE-2021-36934, основан на оригинальном скрипте Joran Slingerland https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 PowerShell-скрипт выполняет...
CVE-2020-1337
CVE-2020-1337 - Binary Planting contournement de CVE-2020-1048 Peleg Hadar @peleghd et Tomer Bar de SafeBreach @safebreach ont été remerciés par Microsoft pour le CVE-2020-1048, une vulnérabilité du spooler Windows qui permet une élévation de privilèges sur Windows 7 et versions ultérieures...
HardBreacher
HardBreacher Kaspersky Antivirus For Endpoint のゼロデイ権限昇格の脆弱性 この問題は今やMicrosoftの外にも漏れ出しています。ホーム版か商用版のどちらかにバグを見つけるかという投票が行われ、投票結果は商用版となりました。 これを書いている時点で、この概念実証は完全にパッチが適用されたWindows 11 25H2とKaspersky for Endpoint v14.0.0.504で動作します。...
CVE-2026-13133
A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...
EUVD-2026-55033
A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...
CVE-2026-13133
LineInst.exe (LINE for Windows) before version 26.4.0 is vulnerable because Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer directory to be loaded ahead of the legitimate System32 copy. The CVSS metrics indicate a HIGH ...
CVE-2019-18194
TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder...
CVE-2023-53937
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937
Hubstaff 1.6.14 is affected by a DLL search order hijacking vulnerability that enables replacing the missing system32 wow64log.dll with a malicious library. An attacker could generate a custom DLL (e.g., via Metasploit) and place it in the system32 directory to obtain a reverse shell when the app...
CVE-2023-53937 Hubstaff 1.6.14 DLL Search Order Hijacking via wow64log Library
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937: Uncontrolled Search Path Element
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
PT-2025-52316
Name of the Vulnerable Software and Affected Versions Hubstaff version 1.6.14 Description The software contains a DLL search order hijacking issue. An attacker can replace a missing system32wow64log.dll with a malicious library. By using tools like Metasploit to create a custom DLL and placing it...